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SELF-TEACHING DIGITAL-COMPUTER PROGRAM FOR 
FAIL-OPERATIONAL CONTROL OF A TURBOJET 
ENGINE IN A SEA-LEVEL TEST STAND 
by Robert E. Wallhagen and Dale J. Arpasi 
Lewis Research Center 

SUMMARY 

This report describes the design and evaluation of a digital turbojet engine control 
which is capable of sensing catastrophic failures in either the engine rotor speed or the 
compressor discharge static -pressure signal and is capable of switching control modes 
to maintain near normal operation. The control program was developed for and tested 
on a turbojet engine located in a sea-level test stand. The control program is also 
capable of acquiring all the data that are necessary for the fail -operational control to 
function. 

Experimental results are presented to show that the fail -operational control for en- 
gine rotor speed or for compressor -discharge static pressure matches very closely the 
normal engine response. Results also show that a fail -operational control for a com- 
bined failure of engine rotor speed and compressor -discharge static pressure operates 
in a reasonable fashion, even though it is an open-loop control. Failure detection for 
catastrophic failures is demonstrated, and control mode switching from normal to fail- 
operational control is demonstrated during transient operation. 


INTRODUCTION 

In recent years the state of the art in flight -worthy digital computers has reached 
the point where digital computation is a serious choice for the control of all aircraft 
systems. These include the flight and navigation system, the engine propulsion control 
system, the inlet control systerh (where applicable), the cockpit and cabin environmental 
control system, and the weapons control system (military). A compelling reason for 
digital computation for all these aircraft systems is its ability to integrate all system re- 
quirements into an overall mission control system. Digital computation also offers in- 



creased flexibility in being able to change control algorithms without hardware changes. 
Highly complex programs needed for optimal or self -optimizing control are more ade- 
quately handled digitally. Other interestii^ areas that can use digital computation to ad- 
vantage include engine diagnostics, sensor failure detection, and fail -operational control. 

The main purpose of the study covered in this report was to investigate the use of a 
digital computer for turbojet engine sensor failure detection and fail -operational engine 
control. In this report the term fail -operational control is used to mean a control that is 
able to encounter the failure of a sensed control variable and still be capable of normal 
or near normal operation. A fail-safe control, on the other hand, would set engine oper- 
ating limits such that it is safe to run without the failed control variable, or in the case 
of a critical variable, would set one fixed operating point. 

A secondary purpose of the study evolved part way through the program. Once the 
fail -operational control system was developed, it was realized that the data taking needed 
for the fail -operational control scheme could be done by the computer. Thus, a second 
purpose of the study was to demonstrate that the digital computer could be programmed 
to learn the information needed for fail -operational control while operating in its normal 
control mode. This concept would make the control program applicable to all turbojet 
engines of the same configuration with the identical control programs. 

The experimental study was conducted in a sea-level static engine cell. The test 
engine was a single -rotor afterburning torbojet, although the study did not cover after- 
burning operation. The control signals included in this study were ei^ine rotor speed 
and compressor -discharge static pressure. The fail -operational control was evaluated 
by comparing transient step responses of engine rotor speed and engine gross thrust with 
correspondii^ responses under normal engine control. 

Control variable failures were limited to the rotor speed signal and the compressor- 
discharge static -pressure signal. Detection was limited to catastrophic failures only. 

A catastrophic failure is one where the measured signal goes very rapidly to zero or an 
upper saturation limit. 

A prior study done at Lewis and presented in reference 1 investigated digital control 
of a turbojet engine and the effect of digital -computer update interval on engine response. 
The same digital computer, control program, and test facility were used in this study. 

This report describes the following: (1) the experimental test facility, (2) the 
philosophy behind the fail -operational control, (3) the procedure whereby the computer 
could self -teach the information necessary for fail -operational control, and (4) the test 
results under actual fail -operational control. 
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SYMBOLS 


2 

Ag exhaust -nozzle area, cm 

N engine rotor speed, percent 

2 

?2 compressor -inlet total pressure, N/cm 

2 

Pg compressor-discharge static pressure, N/cm 

Tg compressor -inlet total temperature, K 

Tg turbine -discharge total temperature, K 

Wj fuel flow, kg/sec 

compressor variable geometry position 
a throttle position, deg 


EXPERIMENTAL CONFIGURATION 
Engine Description 

The engine used in this experimental study is illustrated in figure 1. Inlet air 
passes throi^h inlet guide vanes into an eight -stage compressor. Air bleed doors are 
located on the third, fourth, and fifth compressor stages and along with the inlet guide 
vanes are referred to as the compressor variable geometry. The inlet guide vanes are 
mechanically coupled to the bleed doors, and the entire compressor variable geometry 
is driven by mechanically coupled hydraulic actuators located on opposite sides of the 
ei^ine. The compressor variable geometry servomechanism control loop is scheduled 
to optimize compressor performance over its complete range of operation. 

A fuel control regulates the fuel flow into the burner. The fuel flow passes through 
a pressurizing and drain valve and an overspeed governor before it enters the burner 
spray bars. The fuel and compressor variable geometry controls are located together 
in one of two hydromechanical packages located beneath the engine. 

Control of the variable exhaust -nozzle area is provided by the other hydromechanical 
package. The output of this control is a mechanical position used to command three 
linear translating mechanical actuators coupled to the exhaust -nozzle unison ring. Mo- 
tion of the unison ring moves the nozzle leaves and thus varies nozzle throat area. 
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Modifications for Digital Control 


The Standard hydromechanical engine control system was modified (1) to permit 
selective substitution of either digital control or standard hydromechanical control of 
compressor variable geometry, fuel, and variable nozzle area and (2) to permit easy 
switching between the two types of control (for safety reasons). Hydromechanical com- 
putation of each control schedule was maintained, except for the compressor variable 
geometry. The hydraulic output from the standard hydromechanical control normally 
used to drive the compressor variable geometry actuators was inactivated. The com- 
pressor variable geometry control schedule was implemented on a special purpose elec- 
tronic analog computer. 

The block diagram of the experimental configuration is shown in figure 2. A servo- 
amplifier, of the type described in reference 2, was used to drive a servovalve to form 
the compressor variable geometry position loop. The servovalve powered the standard 
actuators; and their position, as measured by an engine -mounted linear potentiometer, 
was fed back to the servoamplifier to close the position loop. The command to the com- 
pressor variable geometry servoamplifier could be switched from either the analog com- 
puter schedule or the same schedule programmed on the digital computer. 

The main fuel control was left intact, with the exception of a four -way switching 
valve which was inserted in the engine fuel supply line just ahead of the overspeed gov- 
ernor. This allowed manual switching of engine fuel flow between the hydromechanical 
control and the digital control. The digital command scheduled the output of a fast- 
response fuel metering device (ref. 3) whose output was sent to the four -way switching 
valve. The selected fuel was ported by the valve to the engine, while the unselected fuel 
was ported to drain through a dummy load. 

The standard hydromechanical exhaust -nozzle control determines the position of a 
mechanical arm located on the exhaust -nozzle -control package. This arm is normally 
used to drive a power pack which in turn drives mechanical screwjack actuators at- 
tached to the nozzle leaves through a unison ring. This system was modified by replac- 
ing the mechanical screwjack actuators with hydraulic actuators and closing a servo- 
mechanism position control loop around them in the same way as described for the com- 
pressor variable geometry control. The power pack was removed, and a linear variable 
displacement transformer (LVDT) was installed to measure the position of the mechani- 
cal arm. The LVDT output was scaled and linearized by an analog function generator so 
that the proper unison ring position command was presented to the exhaust -nozzle servo- 
amplifier. The command to the exhaust -nozzle servoamplifier could be switched from 
either the analog function generator or an equivalent digital schedule. 

Signal conditioners were used to provide h^h -level signals (-10 to 10 V) from the 
transducer measurements. Throttle position a was measured by attaching a rotary 
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potentiometer to the shaft of the throttle input to the hydromechanical fuel control. A 
static-pressure tap, attached to a high-response gage transducer, was used to measure 
compressor-discharge static pressure Pg. Ei^ine rotor speed N was measured by 
attaching a special gear to the engine -power takeoff and counting gear teeth with a mag- 
netic pickup. The resultant frequency was converted to a voltage proportional to rotor 
speed before being routed to the digital system. Thermocouples were used for measure- 
ment of both compressor -inlet temperature Tg and turbine-exit temperature Tg. An 
absolute pressure transducer was used to provide an ambient pressure Pq measurement 
for use in correcting pg to absolute. 

The digital system ground was isolated from the experiment through isolation ampli- 
fiers. This arrangement eliminated the possibility of ground loops and provided rela- 
tively noise -free measurements. 


Digital Computer 

The digital computer used in the study is a 16-bit machine with 16 384 words of mag- 
netic core storage. It has a read-restore memory cycle time of 750 nanoseconds. An 
interface unit to the computer contains a high-level multiplexer, a single sample -and- 
hold amplifier, and a 13 -bit digitizer to provide analog -to -digital conversion of the six 
measured signals. Digital -to -analog conversion of the computer commands is also 
accomplished in the interface through 13 -bit digital -to -analog conversion units. The 
analog commands for compressor variable geometry X^g, fuel flow Wj, and exhaust- 
nozzle area Ag are obtained throi^h separate digital -to -analog converters. Program- 
ming of the computer is done through a teletype and high-speed paper tape reader and 
punch. All control programming is done in assembly language to conserve core storage 
and execution time. A detailed description of the digital -computer system is presented 
in reference 4. 


Test Facility 

The turbojet ermine was located in a sea -level static test stand. Outside air entered 
the cell through large louvers in the roof. No provisions were available to control or 
alter the inlet air temperature. Temperature and pressure varied a small amount from 
day to day, and temperature varied considerably with seasons. However, for a given 
test of a few hours, both were essentially constant. 
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PROCEDURE 


Design Philosophy 

There is a very straightforward idea behind the development of this fail -operational 
control. The central idea is to synthesize each control variable of interest from the re- 
maining sensed control variables. Then if a failure of a signal is detected, the control- 
ler simply switches modes of operation and uses the synthesized control variable in 
place of the failed sensed control variable. 

In this study, the method used to synthesize a failed variable is to tabulate values of 
the particular variable in terms of the other sensed variables. This involves tabulating 
one sensed variable against a second for given values of the rest of the variables. In- 
terpolation is used to find information between the fixed values in the tables. To cover 
a full operating range for all variables requires many tables. Empirical equations could 
have been derived from tabulated data; however, they are generally difficult to obtain 
and are less accurate over the whole operating range because of the essentially nonlinear 
engine relations. 


Description of Normal Engine Control 

For the purpose of this study, the normal ei^ine control is the digital -computer 
control programmed with the standard hydromechanical engine control laws. 

Before the fail -operational engine control is described and the tables that are needed 
are explained, a basic description of the normal or standard fuel control laws is neces- 
sary. The normal control operates by scheduling the ratio of engine fuel flow to 
compressor-discharge static pressure W^/pg as a function of engine rotor speed N 
and the input command throttle angle a. The ratio W^/pg is multiplied in the control 
by pg to yield the fuel flow command to the engine fuel valve. The schedules shift with 
varying compressor-inlet temperature Tg. For a fixed Tg, a sketch of a map of 
Wj/pg as a function of engine speed is presented in figure 3. The throttle angle a 
commands W^/pg units inversely with engine speed and yields what is referred to as 
droop line speed governing. Steady -state operatii^ conditions for the engine are indi- 
cated by the long -dash line. Thus, for a fixed throttle input a, the engine will be oper- 
ating at a point a in figure 3. If the command input is changed to ag, the droop gov- 
erning control will try to schedule W^/pg units defined by the intersection of the Og 
droop line and a constant -speed line passing through point a. This value of fuel flow 
would surge or stall the compressor or overheat the turbine. Therefore, an accelera- 
tion limit is incorporated in the engine control which limits W^/pg units to the inter - 
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section of the constant- speed line and the acceleration limit line. The increased fuel 
flow will accelerate the engine along the short -dash line to operating point b. A decel- 
eration limit is also shown in figure 3. This limit is active during decreases in throttle 
angle to maintain sufficient fuel flow to prevent combustor blowout. 


Design for Sea -Level Static Test 

The sensed variables for the turbojet engine control include engine rotor speed N, 
compressor -discharge static pressure pg, compressor-inlet temperature T 2 , turbine- 
discharge temperature T^, and pilot command throttle angle a. The only sensed var- 
iables considered for fail -operation control development were N and Pg. The problem 
of tabulating N or pg as functions of all the other variables is much simplified for the 
sea -level test, where Tg and Pg are essentially constant. It was determined empiri- 
cally that engine speed can be synthesized solely as a function of compressor -discharge 
static pressure, and vice versa. This was true during both steady-state and 
acceleration-deceleration limit operation of the engine and was, of course, due to the 
repeatability of the control. In addition, it was determined that each was a single- 
valued function of the other. An exception to this occurs during Tg override, when the 

exhaust -nozzle area is varied from its normal schedule to limit T- to 980 K. A modi- 

I I ° 

fication to the normal control schedules for fail -operational work which eliminates Tg 

override operation is described in this section. 

The normal turbojet engine operation can be broken down into three limiting cases. 

If the pilot a input is changed very slowly, the engine operates on its normal steady - 
state operating line. If the a input changes very rapidly, the engine control sets engine 
operation to an acceleration limit or a deceleration limit. For the purpose of tabulating 
data for the fail -operational controls, only these three limiting cases were considered. 
To simplify the fail -operational control further, separate data for the deceleration limit 
were not incorporated. This could be done because the deceleration limit is a constant 
Wf/pg value as a function of speed (see fig. 3). If the synthesized speed variable being 
used by the control during a speed signal failure is in slight error during a deceleration 
transient, it will not affect the value of W^/pg given by the deceleration schedule. 

A plot of compressor -discharge static pressure pg as a function of engine rotor 
speed N for normal digital control is presented in figure 4. It can be seen that a prob- 
lem exists for tabulating values during acceleration, as the normal control exhibits a 
rotor speed overshoot and undershoot during step changes to 100 percent speed. Thus, 
for some speeds near 100 percent, Pg is double or even triple valued. To avoid this 
problem, the normal droop line control laws had to be modified slightly for fail- 
operational operation. The largest modification to the control was to limit the throttle 
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command a during acceleration to a value which would yield 98 percent rotor speed. 
When the engine had accelerated to 98 percent speed, the control would allow the a 
command to increase at a fixed rate limit until it reached the pilot’ s commanded value 
or a preset maximum limit, whichever was less. The present maximum limit, which is 
less than the normal maximum throttle stop, was included to compensate for an exhaust- 
nozzle schedule modification which was made to avoid Tg override operation. Under 
normal scheduled operation the exhaust nozzle would close to its minimum area at ap- 
proximately 100 percent speed. This would cause Tg to exceed the 980 K limit, and 
the Tg override circuit would open and the modulate the exhaust -nozzle area to maintain 
Tg at 980 K, This modulation of the exhaust -nozzle area as a function of Tg would 
affect the simplified Pg against N relation near 100 percent speed and thereby make it 
impossible to synthesize accurately either N from pg or Pg from N. Thus, the 
exhaust -nozzle schedule was modified for fail -operational control to include a minimum 
area limit that was larger than the normal minimum area. With this larger minimum 
area, Tg override was avoided; however, the decreased nozzle resistance caused a 
2- to 3 -percent rotor overspeed at maximum a. Thus, the present maximuni limit was 
included on the a command for fail -operational control. A final modification to the 
normal control for fail -operational operation was to change the droop line slopes above 
85 percent rotor speed. The droop slopes were changed to three-quarters of their nor- 
mal values. 

A generalized block diagram of the fail -operational control is presented in figure 5. 

It shows how a failure detector on either N or pg will switch the control input from the 
real sensor signal to the synthesized signal. Either of the failure detectors will also 
switch the control outputs from their normal scheduled values to fail -operational outputs 
that include the control modifications to the a input, the exhaust -nozzle area limit, and 
the droop slope. 

The actual tabulated data for the N and Pg fail -operational controls are plotted in 
figure 6. In the computer program N is tabulated against Pg for pressures from 13. 8 
to 69 newtons per square centimeter at increments of 1. 38 newtons per square centi- 
meter; Pg is tabulated against N for percentages of maximum speed from 40 to 
1 10 percent at increments of 2 percent speed. The data for Pg against N and N 
against pg are essential redundant information and are stored separately in the com- 
puter for ease of access. 

Both tables of data are plotted together in f^ure 6. Figure 6 presents data for both 
steady-state operation and operation during acceleration. The plot of acceleration data 
stops at 95 percent speed because the normal control comes off the acceleration limit at 
that speed. The data in figure 6 were learned by the self -teaching prc^ram which is 
described in the next section. Data are presented only from 53 to 99 percent because 
those were the limits of steady -state operation for the given test. The program fills in 
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the bottom and top of the tables with preselected values, so there is no danger of the 
fail -operational control reading a zero or blank table location. 

A third mode of fail -operational control was developed for combined N and Pg 
signal failures. This control was simply an open-loop schedule of steady-state engine 
fuel flow Wj as a function of a. The tabulated data for steady -state as a function 

of a are presented in figure 7 (upper left plot). Although only one table of data was 
needed for scheduling, two more tables were needed for complete operation. One 
of these tables, the upper right plot in figure 7, was steady-state engine rotor speed N 
as a function of a. This table is needed because the compressor variable geometry 
control is a schedule of commanded variable geometry position against engine corrected 
speed. These first two tables depend upon steady-state engine operation. To ensure 
operation close to steady-state, the combined N and p^ fail -operational control mode 
was designed with a rate limit for increases in a. Thus, if the pilot commanded maxi- 
mum a, the control would act as though the pilot was moving the throttle very slowly up 
to maximum. There was no limit for decreasing a, because all steady-state Wj com- 
mands are above the deceleration limit and close adherence to the variable geometry 
schedule is not critical during deceleration. To avoid deviations from steady-state oper- 
ation that could occur if a combined N and pg failure occurred during a transient, a 
third table was needed. This table (lower plot in fig. 7) contained a as a function of 
steady -state engine speed. When a combined N and pg failure was detected, this 
third table was entered with the last value of engine rotor speed to determine the effec- 
tive steady-state pilot throttle angle. This a command was then increased at the fixed 
rate limit until it matched the pilot's command. 

Again it will be noted that there are redundant tabulated data in the digital -control 
program. There are separate tables for N against a and a against N as well as 
the previously mentioned N against pg and pg against N tables for both steady- 
state and acceleration operation. These were included because storage space was no 
problem and the available interpolation routine required abscissa data at even incre- 
ments. 

For the first try at using the fail -operational program, data were taken manually 
during normal operation to fill the required tables. This was done through a steady - 
state data acquisition system and by usii^ x, y-plotters and strip recorders for the dy- 
namic data. Then the data were scaled and manually programmed into the digital com - 
puter. At this point it became obvious that the computer could be programmed to do the 
data taking necessary to fill the tables. Such an addition to the computer fail- 
operational program could be called a self -teaching mode. 
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Description of Self -Teaching Program 


There are two types of tables needed for the complete fail -operational control pro- 
gram. These are the steady-state data tables and the data tabulated during operation on 
the acceleration limit line. 

During normal operation, under digital control the digital computer is sampling all 
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control variables every 15 milliseconds or 66 g times per second. To determine if the 
engine is operating at steady state, all variables are checked to see If they have changed 
more than 0. 25 percent of their full-scale value during the last five sampling intervals. 

If none of the variables have changed more than the 0. 25 percent, the control program 
assumes the engine is at steady state. All the variables of interest are then set aside 
for storage. The routines to do the actual storing are discussed in this section. As part 
of the normal control calculations, Wj/pg units are calculated by using both the droop 
line and the acceleration limit. A selector then chooses the lesser of the two Wj/pg 
values. If the lesser value is the acceleration limit value, indicating operation on the 
acceleration limit, an acceleration limit indicator latch is set. This latch is used in 
another portion of the normal control to set the exhaust nozzle to a fixed, substantially 
open area for quick acceleration. This latch is also used by the self -teaching program. 
Whenever the latch indicates operation on the acceleration limit, the control sets aside 
readings of all variables of interest for storage in the acceleration limit tables. 

All of the tables are predefined in terms of the range and increment of the abscissa 
variable. For example, for the tables of N against pg, pg is the abscissa variable and 
the table is defined for a range of 13. 8 to 69 newtons per square centimeter in incre- 
ments of 1. 38 newtons per square centimeter. The ranges of all tables and the incre- 
ment sizes are listed in table I. The storage routine takes the data and determines if the 
abscissa variable matches a location in the table to within ±20 percent of the table incre- 
ment. K the abscissa variable meets this requirement, the ordinate variable is stored 
in the table. A counter is provided to count the number of times data are stored in each 
table slot. All new data are averaged with the previously stored data. A limit can be 
set such that after that number of data points are averaged, future data are ^nored. If 
a sensed variable signal failure is sensed, the teaching routines are locked out to prevent 
the control from learning any additional data. To prevent the fail -operational control 
from using a table that is not completely filled, a check routine is used prior to switch- 
ing to the fail -operational mode. This check routine generates data for any blank slots 
in the table by interpolation, using data above and below the blank slot. The routine was 
programmed to handle up to two blank slots in succession. The check routine also fills 
in the top and bottom lines of the table with predefined values. This feature is needed 
because during the learning process the ei^ine may not be run to the extremes of its op- 
erating range, and the tables have to be defined to cover all possible extreme conditions. 
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Thus, portions of the tables at the low and high end remain blank during normal opera- 
tion and learning. 

An indicator routine was built into the fail -operational control to determine if the 
tables were filled. It checked the counter for each table location to determine if there 
were a given number of data points averaged for all locations. The indicator routine 
controlled a panel of display lights that could be used for a cockpit display. There were 
separate lights for each table to indicate if each table was considered learned. There 
was also a display light that was lit when the teaching program determined steady -state 
operation. Display lights were also provided to indicate which sensed variable failures 
had occurred and when the computed a command was being rate limited (because of 
failure of both pg and N). 

The self -teaching program is capable of learning and filling a sufficient amount of 
all tables in less than 5 minutes of operation under normal control. All that is neces- 
sary is one slow ramp from idle to 100 percent speed to learn the steady-state tables 
and one or two full acceleration transients from idle to 100 percent speed to learn the 
acceleration limit tables. 


Feilure Detection 

As was stated in the INTRODUCTION, failure detection was limited to detecting 
catastrophic failure in the sensed signals for N and pg. Catastrophic failure was in- 
dicated when the rate of change of either variable exceeded a preset value. Because the 
control sampled all variables at a fixed frequency, the difference between two succes- 
sive samples indicated rate of change. This difference between two successive samples 
was limited to 6. 4 percent speed for N and 4. 4 newtons per square centimeter for pg. 
Any change greater than those limits indicated a failure. The limits used were rather 
arbitrary, but they reliably indicated catastrophic failures. For a time between sam- 
ples of 15 milliseconds used by the control, these absolute change limits translated to 
rates of 430 percent speed per second and 290 newtons per square centimeter per sec- 
ond. Both of these limits were far above anything that would occur during normal en- 
gine steady-state or transient operation. To avoid the possibility of sensing a false 
failure due to a large noise spike, the failure detection program waits for four succes- 
ive samples to remain outside the absolute change limit. 

The failure detection program is capable of switching back to normal control if a 
failed signal corrects itself. The program continues to monitor the failed signal and 
compares it to the synthesized value used for fail -operational control. If the sensed 
signal comes within fixed preset limits of the synthesized signal, it is assumed that the 
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failure no longer exists. The fixed limit to determine when a failure is corrected is 
equal to one-haK of the limit that determines failure. 


RESULTS 

The fail -operational controls for both engine rotor speed and compressor-discharge 
static pressure were evaluated by comparing step responses of ei^ine rotor speed and 
gross thrust with the same responses obtained under normal control. A plot of the step 
responses of engine rotor speed for the normal control, the N fail -operational control, 
and the Pg fail -operational control is presented in figure 8. The step responses are 
from idle to the 100-percent speed setting. As shown in figure 8, the responses are es- 
sentially identical from idle to the 9 5 -percent speed point. Above 95 percent speed the 
normal control exhibits a marked overshoot and undershoot of the 100-percent speed 
point. The two fail -operational controls exhibit a very slight peak prior to following the 
rate limited a to the maximum setting. The fail -operational controls do not quite reach 
the military setting because of slight discrepancies in their data tables. To avoid having 
these discrepancies cause an overspeed condition the preset maximum limit on the a 
command is set slightly lower than needed to compensate for the exhaust -nozzle area Ag 
modification. The response did not start from 50 percent speed because the idle throttle 
angle setting did not yield 50 percent rotor speed for the particular inlet temperature for 
which the data were taken. 

Figure 9 shows the step responses of engine gross thrust for the same controls and 
conditions as for figure 8. The responses are essentially identical for time up to 2.35 
seconds, which corresponds to the 95-percent engine speed point. The final thrust val- 
ues for the fail -operational controls are lower than those for the normal control because 
of the modified Ag schedule. With the Ag area held more open during fail -ope rational 
control to avoid surpassing the Tg limit, maximum thrust can not be obtained. How- 
ever, the fail -operational controls still obtain more than 92 percent of the normal thrust. 
The difference in final values between the N and Pg fail -operational controls is due to 
the difference in their final speed settings (note fig. 8). For a short period, between 
approximately 2.35 and 2.75 seconds, the fail -operational controls exhibit more thrust 
than the normal control. This is due to the fact that the fail -operational controls come 
off the acceleration limit before the normal control. The exhaust -nozzle control com- 
mands a substantially more open acceleration area when the engine is operating on the 
acceleration limit. This acceleration area ensures fast acceleration, but it does not 
yield fast thrust response. When the exhaust -nozzle area closes from its acceleration 
area setting at high engine speeds, thrust increases rapidly. Thus, for a short duration 
of time the fail -operational controls command a more closed Ag and hence more thrust. 
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The response of turbine -discharge temperature Tg for the normal control and the 
N and Pg fail -operational controls is presented in figure 10. It is presented to show 
that the simple limit on the Ag schedule easily avoids Tg temperature extremes. The 
normal control has a Tg limit set at approximately 980 K. A Tg control circuit over- 
rides the normal Ag sehcdule and modulates Ag area to control Tg to its maximum 
limit. The difference between the final Tg values for the two fail -operational controls 
is again due to tabulation inaccuracies. 

Figure 11 presents a plot of the digital -computer -generated W^/pg command as a 
function of engine rotor speed for the transient responses of figures 8 to 10. This plot 
is presented to show how the fail -operational controls come off the acceleration limit at 
a lower a setting and how the droop slope is changed to three-quarters of the normal 
slope. The difference in the point where the N and pg fail -operational controls leave 
the acceleration limit line is due to the synthesized value for N in the N fail- 
operational control being slightly off. The Pg fail -operational control knows the actual 
rotor speed, so its droop line is defined correctly. 

The response of engine rotor speed for the combined N and Pg fail -operational 
control is presented in figure 12, The response time is 30 seconds from idle to 99 per- 
cent speed. This control was programmed to show the capabilities of the digital control, 
and no effort was spent in trying to optimize it. The response of engine thrust for the 
combined N and pg fail -operational control is presented in figure 13. In comparing 
thrust output with figure 9, it is noted that the combined failure control has the least 
final thrust, approximately 87 percent of the normal control maximum thrust. This 
again is due to inaccuracies in the tabulation process. The table of against a is 
especially susceptible to inaccuracies because the change in per change in a in- 
creases rapidly at high a values. Because of these table inaccuracies, the maximum 
o; limit had to be set lower than for the other fail-operational controls. Thus, although 
the rotor speed almost reached 99 percent, it was for a more open Ag and hence a 
lower Tg and lower gross thrust. 

Figures 8 to 10 amply show how well the fail -operational controls perform during 
transient operation. The next real test was to demonstrate how the control performed 
when a failure occurred during an acceleration transient. To demonstrate this, the 
same 50- to 100-percent rotor speed step responses were used. The step was initiated 
with the engine at idle under normal digital control. As engine rotor speed passed be- 
tween 60 and 70 percent, a failure of either the N or pg signal was generated. Fig- 
ure 14 presents the complete step response for both cases. A comparison with figure 9 
indicates that the responses are essentially identical. There is no noticeable diversion 
from the normal acceleration path when either failure occurs. Figure 15 presents the 
thrust responses for the same cases as shown in figure 14. Figure 16 presents a time 
history of the digital -control throttle angle command. Up until a failure is detected, the 
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control a command is equal to the pilot' s a input. After a failure occurs, the control 
a command is reset to the 98 -percent steady-state rotor speed throttle angle setting. 
This acceleration a limit lasts until the engine reaches the 98 -percent speed condition. 
The rate limit moves the a command up to the maximum failed a limit. 

Figure 17 presents the time response of an idle to 100-percent speed step, starting 
under normal control and subsequently suffering an N failure at approximately 60 per- 
cent speed and a Pg failure at approximately 70 percent speed. The engine continues to 
accelerate normally after the N failure occurs, but has to revert to the open loop, 
rate limited, fuel flow schedule once pg fails. Figure 18 presents the time history of 
the digital-control -generated a command for the transient shown in figure 17. For the 
first 3/4 second the control a command follows the pilot's input. After the N failure 
occurs, the a command is reset to the fail -operational acceleration limit corresponding 
to 98 percent steady-state speed. After the Pg failure occurs, the control uses the last 
speed value (synthesized under N fail -operational control) and resets the control a 
command to the value that corresponds to a steady -state speed equal to the last speed 
measured. From this second a command reset, the a increases at a fixed rate limit 
to its maximum limit. 

To evaluate the fail -operational controls for transients other than full idle to 
100-percent speed steps, small steps in command a were used that moved engine speed 
through 5- and 10-percent speed changes. These small steps were set up for the follow- 
ing speed ranges (in percent): 50 to 60, 60 to 70, 70 to 80, 80 to 90, 90 to 95, and 
95 to 100. The transient responses of engine rotor speed to these small throttle ai^le 
steps are presented in figure 19. The 10-percent steps are presented in figure 19(a) and 
the 5-percent steps in figure 19(b). The response of the fail -operational control is seen 
to be very close to that of the normal control except in two respects. The change in the 
95- to 100-percent speed step is caused by the modification to the a command and 
exhaust -nozzle area. It is interesting, however, to note how similar the 90- to 
95-percent responses are. For the 90- to 95-percent step the fail-operational controls 
are working with 3/4 slope droop lines and with the steady-state data tables, as the con- 
trol does not reach the acceleration limit for that case. The other noticeable difference 
between responses occurs in the final values that were reached. This is especially evi- 
dent for the N fail -operational control under the 60- to 70-percent step. It overshoots 
by 4 percent speed. This large discrepancy was caused by an error in the control pro- 
gram that was not discovered until all the data were taken. The error was in the portion 
of the program which determines whether to use the steady-state or acceleration limit 
data tables. The program uses the acceleration limit data table when the acceleration 
limit latch is set. The error was that, once the program started using the acceleration 
data table, it did not switch back to the steady-state tables until speed reached the 
98 -percent level. This error affected all the steps below 90 percent. The fact that the 
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speed response was low on the 80- to 90-percent step is due to the way the steady-state 
and acceleration curves cross each other (note f:^. 4). 

The final evaluation of the fail -operational controls for N and Pg was based on 
frequency responses of speed to a at the 70-percent speed point and the 90 -percent 
speed point. These frequency responses are presented in figures 20 and 21, respec- 
tively. Both figures show that, although the magnitude responses of the fail -operational 
controls drop off at slightly lower frequency than those for the normal control, they 
are very similar. The responses show that the transfer function from the throttle angle 
command a to engine rotor speed N is a simple lag with a break frequency that is a 
function of rotor speed. The break frequency varies from approximately 0. 5 hertz at 
70 percent rotor speed to approximately 1. 5 hertz at 90 percent rotor speed. 


SUMMARY OF RESULTS 

A digital, self -teaching, fail -operational control for a sii^le rotor turbojet ei^ine 
was designed and evaluated. The control synthesized values for failed sensed variables 
from tabulated data taken during normal operation. These tables of data could be learned 
by the digital computer in less than 5 minutes of running time under normal control. 

The fail -operational control, under a rotor speed N or a compressor -discharge 
static -pressure pg signal failure duplicated the normal control speed response at 
speeds below 98 percent. Above 98 percent speed, the fail -operational controls for N 
and Pg operated with a rate limit on the input command. This yielded no overshoot on 
acceleration transients to 100 percent rotor speed, whereas the normal control exhibits 
a sizable overshoot followed by a similar undershoot before settling to 100 percent 
speed. The fail -ope rational controls set maximum speed to within 1 percent of the 
maximum speed of the normal control and produced a maximum thrust output of more 
than 92 percent of the normal maximum thrust. 

A fail -operational control for combined N and pg failures was demonstrated. It 
ran the engine on an open -loop schedule of fuel flow to command input. Although the 
combined N and Pg fail -operational control was not optimized, it accelerated the en- 
gine from idle to 100 percent speed in 30 seconds and reached almost 99 percent speed 
and better than 87 percent of maximum thrust. 

A failure detection scheme was demonstrated that adequately detected catastrophic 
failures. The program was capable of returning to normal control from the fail- 
operational mode, if a bad signal corrected itself. The control could sense failures and 
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switch modes of control with barely noticeable effects, even during acceleration tran- 
sients. 
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table I. - SELF-TAUGHT RELATIONS TABULATED BY COMPUTER PROGRAM 


Variables tabulated 

Type of table 

Units 

Independent variable 

Range 

Increment 

N as function of 

Steady state 

2 

percent/ (N/cm ) 

13.8 to 69 

1.38 

N as function of 

Acceleration limit 

2 

percent/(N/cm ) 

13.8 to 69 

1.38 

as function of N 

Steady state 

2 

(N/cm )/percent 

40 to 110 

2 

as function of N 

Acceleration limit 

(N/ cm )/percent 

40 to 110 

2 

Wj as function of ol 

Steady state 

(kg/sec)/deg 

12 to 78 

2 

N as function of a 

Steady state 

per cent /deg 

12 to 78 

2 

Qi as function of N 

Steady state 

deg/percent 

40 to 110 

2 



Figure 1. - Cutaway view of engine. 
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Figure 2. - A/lodificatlons to standard hydromechanical control system to permit switching to digital control system. 
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Figure 4 . - Compressor-discharge static pressure as function of en 
gine rotor speed for normal digital control. 
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Figure 5 . - BIxk diagram of fail -operational control. 



Engine rotor speed, N, percent 

Figure 6. - Plot of tabulated values of compressor-discharge static pressure P3 and en- 
gine rotor speed N as functions of each other for fail-operational control programs. 
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Figure 8 . - Step responses of engine rotor speed from idle to 100 percent rotor 
speed for normal digital control and engine-rotor-speed N and compressor- 
discharge total-pressure P 3 fail-operational controls. 



Figure 9. - Step responses of engine gross thrust from idle to 100 percent rotor 
speed for normal digital control and engine-rotor-speed N and compressor- 
discharge static-pressure P 3 fail-operation controls. 
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Figure 10. - Step responses of engine turbine discharge temperature from idle 
to 100 percent rotor speed for normal digital control and engine-rotor-speed 
N and compressor-discharge static-pressure P 3 fail-operational controls. 



Figure 11. - Digital-computer-generated Wj/p 3 as function of en- 
gine rotor speed for normal control and for engine- rotor-speed 
N and compressor-discharge static-pressure P 3 fail-operational 
control. 
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Figure 12. - Step response of engine rotor speed from idle to 100 percent rotor 
speed for combined engine-rotor-speed N and compressor-discharge static- 
pressure P 3 fail-operational control. 
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Figure 13. - Step response of engine gross thrust from idle to 100 percent rotor 
speed for combined engine-rotor-speed N and compressor-discharge static- 
pressure P 3 fail -ope rational control. 




Figure 14. - Step responses of engine rotor speed from idle to 100 percent rotor 
speed with either engine-rotor-speed N or compressor-discharge static- 
pressure P 3 failure occurring during acceleration. 



Figure 15. - Step responses of engine gross thrust from idle to 100 percent rotor 
speed with either engine-rotor-speed N or compressor-discharge static- 
pressure P 3 failure occurring during acceleration. 
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Figure 16. - Digital-computer-generated command throttle angle as function of 
time for test with either engine-rotor-speed N or compressor-discharge 
static-pressure P 3 failure during normal acceleration transient. 



Figure 17. - Step response of engine rotor speed from idle to 100 percent rotor 
speed with both engine-rotor-speed N and compressor-discharge static- 
pressure P 3 failure occurring during acceleration. 
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Figure 18. - Digital-computer-generated throttle angle as function of time for 
test with both engine-rotor-speed N and compressor-discharge static- 
pressure P 3 failure during normal acceleration transient. 



(a) Steps between 50 and 90 percent speed. (b) Steps between 90 and 100 percent speed. 


Figure 19. - Step responses of engine rotor speed for normal digital control and engine-rotor-speed N and compressor- 
discharge static-pressure P 3 fail-operational controls subjected to throttle-position steps equivalent to 10 -percent 
changes in engine rotor speed. 
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Figure 20. - Frequency response of engine rotor speed to command throttle angle. Engine operating 
at 70 percent speed. 
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Figure 21. > Frequency response of engine rotor speed to command throttle angle. Engine operating 
at 90 percent speed. 
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